Few-Shot Learning for IoT Intrusion Detection: An Attention-Based Siamese Network Approach

The Internet of Things (IoT) has garnered significant attention from both industries and the research community. The diverse nature of IoT devices makes them a prime target for cybercriminals. An intelligent intrusion detection system (IDS) can quickly identify multiple types of cyberattacks within an IoT system. However, operational efficiency and safety become challenging issues when managing limited labeled data in IoT networks. This article proposes a novel cyberattack detection scheme using few-shot learning (FSL). The proposed scheme employs a self-attention mechanism with a Siamese network that learns to recognize normal and malicious network traffic patterns through FSL. The Siamese network architecture facilitates efficient sample comparison by learning a shared representation. Incorporating an attention mechanism further enhances its ability to focus on discriminative features, improving attack detection accuracy for rapidly evolving intrusion patterns. The effectiveness of the proposed framework is evaluated through extensive experiments on the latest Edge-IIoTset dataset. The experimental findings demonstrate that the proposed IDS achieved the best accuracy of 99.75% with the complete dataset. In a few-shot performance evaluation, the designed architecture achieved the best accuracy of 78.69%, 81.19%, and 81.83% for 1 shot, 5 shots, and 10 shots, respectively.